The 'typescirpt-cli' npm package (version 1.0.0) includes a postinstall script that XOR-decodes obfuscated byte arrays with the key 'stf2026' to reconstruct a download URL and a PowerShell command. On Windows and Linux with WSL, it downloads an opaque executable ('main.exe') from an unrelated personal GitHub account without version tags or signature verification, saves it to the TEMP directory, and executes it detached. From WSL, it uses a decoded PowerShell bridge to run the binary on the Windows host. Separately, it sends a JSON payload containing node, architecture, and platform information to a hardcoded IP address (193.70.34.101:20099) over plain HTTP, with the host obscured via array-join. The package name is a deliberate typo of 'typescript-cli', indicating a typosquatting attack.

This malicious package can execute arbitrary code on affected systems by downloading and running an untrusted executable, potentially leading to system compromise. The unencrypted transmission of installation metrics to a suspicious IP address may also expose system information. The use of typosquatting increases the risk of unsuspecting users installing this malicious package instead of the legitimate one.

No official patch or remediation is currently documented. Users should avoid installing the 'typescirpt-cli' package version 1.0.0 and verify package names carefully to avoid typosquatting. Remove any installations of this package and scan affected systems for the downloaded executable and related artifacts. Monitor for suspicious network connections to the IP address 193.70.34.101. Check vendor advisories or trusted sources for updates on remediation.